Forensic Imager is a Windows based program that will acquire, convert, or verify a forensic image in one of the following common forensic file formats: DD /RAW (Linux “Disk Dump”) AFF (Advanced Forensic Format) E01 (Encase®) Program Functions Forensic Image provides three separate functions: Acquire: The acquire option allows the investigator to take a forensic […]
How to Mount Forensics image as a Drive using P2 eXplorer Pro
P2 eXplorer Pro is a specialized component of P2C. It allows you to virtually mount forensic images such as raw DD, E01, and even virtual machine images. Free with any puchase of P2C. as local drive letters P2 eXplorer Pro can mount the following image formats: Encase (E01) Forensic Replicator (PFR) SafeBack 1, 2, & […]
How to Convert Encase, FTK, DD, RAW, VMWare and other image file as Windows Drive
Mount Image Pro mounts EnCase, FTK, DD, RAW, SMART, SafeBack, ISO, VMWare and other image files as a drive letter (or physical drive) on your computer. Features of Mount Image Pro It enables the mounting of forensic images including: EnCase .E01, EX01, .L01, .LX01 AccessData .AD1 DD and RAW images (Unix/Linux) Forensic File Format .AFF […]
How to gather Forensics Investigation Evidence using ProDiscover Basic
The ARC Group ProDiscover® Basic edition is a self-managed tool for the examination of your hard disk security. ProDiscover Basic is designed to operate under the National Institute of Standards’ Disk Imaging Tool Specification 3.1.6 to collect snapshots of activities that are critical to taking proactive steps in protecting your data. ProDiscover Basic has a […]
How to study Forensics Evidence of PC using P2 Commander (Part 2)
Now we are studying about the forensic evidence which we have collected in the previous article using P2 Commander. If you want to see the collection of forensic evidence, please click on the below link. http://www.hackingarticles.in/how-to-collect-forensics-evidence-of-pc-using-p2-commander-part-1/ Step-by-Step Guide to Evidence Analysis in P2 Commander Firstly, we will look into the Trash folder (which contains the […]
How to Collect Forensics Evidence of PC using P2 Commander (Part 1)
P2C is a comprehensive digital investigation tool with over ten years of court-approved use by forensic examiners. An integrated database and true multi-threading mean faster processing. Paraben’s trusted email examination tools built P2C for unparalleled network email and personal email archive analysis. Advanced features like Data Triage analysis, Xbox analysis, pornography detection. Installing and Creating […]
How to Create Forensics Image of PC using R-Drive Image
R-Drive Image is a potent utility providing disk image files creation for backup or duplication purposes. A disk image file provides the exact, byte-by-byte copy of a hard drive, partition, or logical disk and allows you to create it with various compression levels on the fly without stopping the Windows OS and therefore without interrupting […]
How to find the usage of files in Remote victim PC (Remote PC Forensics)
Today we are going to learn about managing a bunch of files on a remote system using the forfiles command via meterpreter. Table of Content Introduction to forfiles command Parameters and Syntaxes Achieve Meterpreter on Remote System List all the files of a particular extension modified in last 10 days List all the files of […]
How to Collect Telephonic Evidence for Forensic in Victim PC
Dump it Tool utility is used to generate a physical memory dump of Windows machines. It works with both x86 (32-bits) and x64 (64-bits) machines. The raw memory dump is generated in the current directory, only a confirmation question is prompted before starting. Perfect to deploy the executable on USB keys, for quick incident responses […]
How to Collect Email Evidence in Victim PC (Email Forensics)
Dump it Tool utility is used to generate a physical memory dump of Windows machines. It works with both x86 (32-bits) and x64 (64-bits) machines. The raw memory dump is generated in the current directory, only a confirmation question is prompted before starting. Perfect to deploy the executable on USB keys, for quick incident responses […]